Grow column bodies and wire strings as the data arrives

[iliaal]

Several column loaders size their buffers from server-declared counts before any data has arrived. A packet of a few dozen bytes can therefore make the client allocate gigabytes:

• ColumnVector, ColumnEnum and ColumnFixedString LoadBody resize to the declared row count.
• ColumnString::LoadBody reserves the declared row count and allocates each declared string length up front.
• WireFormat::ReadString zero-fills up to the declared length.

For example, a UInt64 Data block that declares 2^28 rows and then sends nothing reaches 2 GiB of resident memory in under a second. So does a single 2^31-byte String length or FixedString(2147483648) with one row.

Fix: new WireFormat::ReadPODArray starts at 1 MiB, reserves eightfold ahead as data arrives, and zero-fills only the chunk it's about to read. The column bodies and ReadString use it. ColumnString caps its initial row reservation and reads strings above 1 MiB into a dedicated block that grows the same way. The growth arithmetic (WireFormat::NextReadCapacity) can't overflow a 32-bit size_t.

Cost: default 64K-row blocks fit the first step and pay nothing extra. A single 80 MB column body copies 73 MiB while growing (1 + 8 + 64 MiB).

ColumnLowCardinality::Load also ignored the result of loading the index column. With incremental loading a truncated index would come back shorter than the declared row count, so it now throws ProtocolError.

On 32-bit, Client::Impl::ReadBlock() truncated the uint64_t column and row counts to size_t, so a block declaring 2^41 rows came back empty instead of failing. Counts that don't fit now throw ProtocolError.

The FixedString width × rows overflow check is left to #579.

Tests:

• ut/allocation_tracker.cpp records the largest allocation inside a scope. It self-checks that it sees library allocations, and the tests that depend on it skip if it doesn't (for example with a DLL build).
• Seven regression tests assert that a truncated body with a huge declared size throws without any single allocation above 8 MiB. They fail on master, e.g. actual: 134217728 vs 8388608.
• Round-trip tests cover numeric bodies and strings above 8 MiB, which exercises the growth path.
• ColumnLowCardinalityString_Load_TruncatedIndex covers the short index.
• CodedStreamCase.NextReadCapacityDoesNotOverflow checks the growth arithmetic in uint32_t.
• ClientProtocol.RowCountBeyondSizeTThrowsProtocolError runs only where size_t is narrower than 64 bits and skips elsewhere. I ran it in an i386 build (with -Werror off, since master doesn't build warning-clean there): it fails on master and passes with the fix.